| Message ID | 20170427122141.557-2-sr@denx.de (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c index 54d581d407aa..6539f919c57a 100644 --- a/drivers/dma/dmatest.c +++ b/drivers/dma/dmatest.c @@ -535,6 +535,13 @@ static int dmatest_func(void *data) total_tests++; + /* Check if buffer count fits into map count variable (u8) */ + if ((src_cnt + dst_cnt) >= 255) { + pr_err("too many buffers (%d of 255 supported)\n", + src_cnt + dst_cnt); + break; + } + if (1 << align > params->buf_size) { pr_err("%u-byte buffer too small for %d-byte alignment\n", params->buf_size, 1 << align);
When using dmatest with sg_buffers=128 I stumbled upon the problem, that the "map_cnt" variable of "struct dmaengine_unmap_data" was set to 0. "map_cnt" is an "u8" variable, resulting in an overrun when its value is set to src_cnt + dst_cnt, to twice the sg_buffer value. This patch adds a small check to dmatest, so that this confusing error is detected and the test is aborted. Signed-off-by: Stefan Roese <sr@denx.de> Cc: Kedareswara rao Appana <appanad@xilinx.com> Cc: Vinod Koul <vinod.koul@intel.com> --- drivers/dma/dmatest.c | 7 +++++++ 1 file changed, 7 insertions(+)